We have been alerted to a new Phishing scam that effects Quickbook and Intuit customers. Recently, Intuit published a security notice on their website warning customers of a Phishing scam which appears to be a direct email from Intuit’s customer service department using the domain of “intuit-solution”.  This sender is not associated with Intuit nor is it an authorized agent of Intuit. If you receive an email from this domain or any other email that appears suspicious, do not click on any links or attachments, do not reply to the email and do not forward it to anyone. It is recommended that you delete the email. If you mistakenly click or have already clicked on a link or downloaded something from the email, immediately (1) delete the download (2) scan your system using an up-to-date anti-virus program and (3) change your passwords. If you experience any issues and are worried you may have fallen subject to this scam, contact South Jersey Techies for immediate support.

Phishing is a cybercrime aimed to lure individuals into revealing personal information or expose them to downloads of malware that will infect their computer and networks. Phishing baits will impersonate real companies. The imposters are getting harder to spot and not all phishing scams work the same way.  You should never enter your username or password into a Login if you are not 100% confident of the source.  These scams are designed to retrieve sensitive information such as SSNs, credit card information and user names and passwords.

Following basic safety tips can help you keep your information safe:

• Protect your computer with anti-virus software.
• Keep your browser up to date and install any updates as they are pushed.
• Contact your bank and any other financial institutions you use if you are a victim of identity theft. Check with your credit reporting agencies often and spot check for any inconsistencies.
• Report any suspicious emails to your technology provider or third-party vendor so they may be tracked and logged.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

Update 1/28/2022: South Jersey Techies has released OOB updates to fix the Windows L2TP VPN connection issues.

Microsoft released Windows updates to fix security vulnerabilities and bugs as part of the January 2022 Patch Tuesday that came with fixes for six zero-day vulnerabilities and a total of 97 flaws.

These updates also included KB5009566 for Windows 11 and KB5009543 for Windows 10 2004, 20H1, and 21H1.

Problems are being reported rapidly from Windows 10 users and administrators who are trying to make L2TP VPN connections after installing the recent Windows 10 KB5009543 and Windows 11 KB5009566 cumulative updates and receiving the error below. L2TP VPN connections are being reported as broken when attempting to connect using the Windows VPN client by Windows users.

You will also receive an error code in the Event Log entries, code 789, stating that the connection to the VPN failed.

The bug is not affecting all VPN devices and seems only to be affecting users using the built-in Windows VPN client to make the connection. Some users have reported the bug affecting their Ubiquiti Site-to-Site VPN connections for those using the Windows VPN client. The bug also affects connections to SonicWall, Cisco Meraki, and WatchGuard Firewalls, with the latter’s client also affected by the bug.

How to fix the break?

Admins have been forced to remove the KB5009566 and KB5009543 updates, which immediately fixes the L2TP VPN connections on reboot.

However, you face the risk of removing all fixes for vulnerabilities patches released during the January 2022 Patch Tuesday when removing the update due to Microsoft’s bundling of all security updates in a single Windows cumulative update.

Weighing the risks of unpatched vulnerabilities versus the disruption caused by the inability to connect to VPN connections is something all Windows admins need to consider, carefully.

Microsoft’s January 2022 Patch Tuesday fixed numerous vulnerabilities in the Windows Internet Key Exchange (IKE) protocol (CVE-2022-21843, CVE-2022-21890, CVE-2022-21883, CVE-2022-21889, CVE-2022-21848, and CVE-2022-21849) and in the Windows Remote Access Connection Manager (CVE-2022-21914 and CVE-2022-21885) that could be causing the problems.

Unfortunately, there is no known fix or workaround for the L2TP VPN connection issues at this time.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

Looking for something fun and free to do with the kids this season? Stop by our office, tune into 89.9FM on your car stereo and enjoy our Musical Light Display with the family!

Where: 229 North Locust Ave, Marlton, New Jersey 08053

When: 5pm thru midnight every night now until New Years Eve!

Park and Tune into 89.9FM

Park and Tune into 89.9FM

Apple has updated its software for iPhones to address a critical vulnerability that independent researchers say has been exploited by notorious surveillance software to spy on a Saudi activist.

Researchers from the University of Toronto’s Citizen Lab said the software exploit has been in use since February and has been used to deploy Pegasus, the spyware made by Israeli firm NSO Group that has allegedly been used to surveil journalists and human rights advocates in multiple countries.

The urgent update that Apple (AAPL) released Monday plugs a hole in the iMessage software that allowed hackers to infiltrate a user’s phone without the user clicking on any links, according to Citizen Lab. The Saudi activist chose to remain anonymous, Citizen Lab said.

Apple credited the Citizen Lab researchers for finding the vulnerability.

“Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals,” Ivan Krsti?, head of Apple Security Engineering and Architecture, said in a statement.

Krsti? said Apple rapidly addressed the issue with a software fix and that the vulnerability is “not a threat to the overwhelming majority of our users.”

Still, security experts encouraged users to update their mobile devices for protection.

In a statement, NSO Group did not address the allegations, only saying, “NSO Group will continue to provide intelligence and law enforcement agencies around the world with life saving technologies to fight terror and crime.”

The firm has previously said its software is only sold to vetted customers for counterterrorism and law enforcement purposes.

Researchers, however, say they have found multiple cases in which the spyware was deployed on dissidents or journalists. In 2019, Citizen Lab analysts alleged that Pegasus was used on the mobile phone of the wife of a slain Mexican journalist.

In a lawsuit filed in 2019, Facebook accused NSO Group of being complicit in a hack of 1,400 mobile devices using WhatsApp. (NSO Group disputed the allegations at the time.)

The proliferation of easy-to-use mobile hacking tools has given governments around the world a new and stealthy means of targeting adversaries. Sophisticated spyware made by NSO Group and other vendors has been reportedly used from Uzbekistan to Morocco.

The surge in spyware prompted a United Nations panel of human rights experts in August to call for a moratorium on the sale of such surveillance tools. The UN panel said the ban should remain in place until governments have “put in place robust regulations that guarantee its use in compliance with international human rights standards.”

As school, socializing, and many aspects of life have moved online this year, it’s more important than ever that you protect your digital devices and steer clear of cybercriminals. Computer security threats are relentlessly inventive. Masters of disguise and manipulation, these threats constantly evolve to find new ways to annoy, steal and harm. Arm yourself with information and resources to safeguard against complex and growing computer security threats and stay safe online.

Examples of Online Cybersecurity Threats

Computer Viruses

Probably the most eminent computer security threat, a computer virus is a program written to alter the way a computer operates, without the permission or knowledge of the user. A virus replicates and executes itself, usually doing damage to your computer in the process.

What can you do to avoid computer viruses? Carefully evaluate free software, downloads from peer-to-peer file sharing sites, and emails from unknown senders. These things are critical to avoiding viruses. Most web browsers have security settings which can be configured for top defense against online threats. But, as we’ll say again and again, the single most-effective way of fending off viruses is up-to-date antivirus software and monitoring agent, like we include in our Managed Service Plans.

Spyware Threats

A serious computer security threat, spyware is any program that monitors your online activities or installs programs without your consent for profit or to capture personal information.

While many users won’t want to hear it, reading terms and conditions is a good way to build an understanding of how your activity is tracked online. As always, if a company you do not recognize is advertising for a deal that seems too good to be true, be sure you have an internet security solution in place and click with caution.

Hackers and Predators

People, not computers, create computer security threats and malware. Hackers and predators are programmers who victimize others for their own gain by breaking into computer systems to steal, change, or destroy information as a form of cyber-terrorism. These online predators can compromise credit card information, lock you out of your data, and steal your identity. As you may have guessed, online security tools with identity theft protection are one of the most effective ways to protect yourself from this brand of cybercriminal.

Phishing

Masquerading as a trustworthy person or business, phishers attempt to steal sensitive financial or personal information through fraudulent email or instant messages. Phishing attacks are some of the most successful methods for cybercriminals looking to pull off a data breach. Antivirus solutions with identity theft protection can be taught to recognize phishing threats in fractions of a second.

Cyber Safety Tips

• Keep software systems up to date and use a good anti-virus program.
• Examine the email address and URLs in all correspondence. Scammers often mimic a legitimate site or email address by using a slight variation in spelling.
• If an unsolicited text message, email, or phone call asks you to update, check, or verify your account information, do not follow the link provided in the message itself or call the phone numbers provided in the message. Go to the company’s website to log into your account or call the phone number listed on the official website to see if something does in fact need your attention.
• Do not open any attachments unless you are expecting the file, document, or invoice and have verified the sender’s email address.
• Scrutinize all electronic requests for a payment or transfer of funds.
• Be extra suspicious of any message that urges immediate action.
• Confirm requests for wire transfers or payment in person or over the phone as part of a two-factor authentication process. Do not verify these requests using the phone number listed in the request for payment.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.